AsyncRAT Dropped Cache GUID PowerShell Script

Ibrahim Saud@tektrix

•updated Jun 18, 2026•2•0•6

Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.